Bill > S4109

Introduced Session

This bill prohibits a controller of a commercial Internet website or online services from selling sensitive data, which prohibition will apply to all individuals or legal entities regardless of the number of consumers whose data the individual or entity controls or processes. Under existing law: "controller" means an individual, or legal entity that, alone or jointly with others determines the purpose and means of processing personal data; and "sensitive data" means personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which shall include a consumer's account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer's financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; personal data collected from a known child; or precise geolocation data.

AI Summary

Committee Categories

Raj Mukherji (D)*, 

Combined with S2316 (SCS) (on 05/18/2026)

Official Document